feature: add oidc login flow

README.md

@@ -20,10 +20,13 @@ Then open `http://localhost:8000/` and set the API token in the UI.
 
 ## Configuration
 Set in `/etc/skd/env` (see `env.example`):
-- `SKD_AUTH_SECRET`: HMAC secret for bearer tokens (set a strong value).
+- `SKD_AUTH_MODE`: `pam` (default) or `oidc`.
+- `SKD_AUTH_SECRET`: HMAC secret for bearer tokens/cookies (set a strong value).
 - `SKD_TOKEN_TTL_SECONDS`: token lifetime (default 900s).
-- `SKD_AUTH_ALLOWED_USERS`: optional comma list of accounts allowed to log in.
-- `SKD_AUTH_ALLOWED_GROUPS`: groups whose members may log in (default `sudo`).
+- `SKD_AUTH_ALLOWED_USERS`: optional comma list of accounts allowed to log in (used for PAM and as an allowlist for OIDC claims).
+- `SKD_AUTH_ALLOWED_GROUPS`: groups whose members may log in (PAM only, default `sudo`).
+- `SKD_OIDC_*`: `ISSUER`, `CLIENT_ID`, `CLIENT_SECRET`, `REDIRECT_URI`, `SCOPES` to point at your OIDC provider; set `SKD_SESSION_COOKIE_SECURE=true` for HTTPS.
+- OIDC dynamic registration helper: `scripts/register_oidc_client.sh` (requires `OIDC_INITIAL_ACCESS_TOKEN` and `SKD_OIDC_ISSUER`; uses `SKD_OIDC_REDIRECT_URI` for the redirect). Run once during setup if your provider issues initial access tokens for client creation.
 - `SKD_ALLOWED_USERS`: optional comma list to limit manageable accounts (must exist on the system).
 - `SKD_DEFAULT_COUNTDOWN`, `SKD_DEFAULT_SOUND`, `SKD_NOTIFY_TIMEOUT`: behavior defaults.
 - `SKD_DRY_RUN=true` to test without real account changes or shutdown.
@@ -34,7 +37,8 @@ Notes:
 ## Running
 - Service: managed by systemd; `./scripts/install.sh` writes the unit dynamically to `/etc/systemd/system/skd.service` with the current repo path and restarts it.
 - Manual run: `./scripts/run.sh` (uses `.venv`, defaults to `0.0.0.0:8000`).
-- Login: `curl -X POST -H "Content-Type: application/json" -d '{"username":"root","password":"..."}' http://localhost:8000/login`
+- Login (PAM): `curl -X POST -H "Content-Type: application/json" -d '{"username":"root","password":"..."}' http://localhost:8000/login`
+- Login (OIDC): open `http://localhost:8000/login/oidc/start` → provider → redirected back with session cookie set.
 - Health: `curl -H "Authorization: Bearer <token>" http://localhost:8000/health`
 
 ## API (Bearer token via `/login`)
@@ -42,6 +46,7 @@ Notes:
 - `POST /users/{name}/disable` with JSON `{countdown?, sound?, message?}`
 - `POST /users/{name}/enable`
 - `GET /health`
+- `GET /me` (returns current user + auth mode when a session/bearer token is present)
 
 Example:
 ```bash
@@ -53,7 +58,7 @@ curl -X POST -H "Authorization: Bearer $token" \
 ```
 
 ## Web UI
-Served at `/`. Login mit Root-Account, danach werden verfügbare System-User angezeigt; Aktionen senden Bearer Token automatisch.
+Served at `/`. Nutze den Button „Login via OIDC“ (setzt Session-Cookie) oder das PAM-Formular, falls OIDC deaktiviert; danach werden verfügbare System-User angezeigt und Aktionen senden Token/Cookies automatisch.
 
 ## Updates
 - Remote update via SSH: `ssh user@kid-laptop 'cd /opt/sk && ./scripts/update.sh'` (fetch/reset to `origin/main`, reinstalls deps, restarts service).